Local and remote audits
Inspect source code, scan a live URL, and add authentication without crossing origins.
Audit local source
A local audit reads the repository from disk. It can inspect code, configuration, dependencies, migrations, Git history, containers, infrastructure files, and CI workflows without uploading the project to Platform.
Control local scope
Run from the intended root and review .viceignore before suppressing generated or vendor paths. VICE follows its file and repository budgets, but very large history or dependency trees can still affect runtime.
Scan a live application
A remote scan inspects the deployed application from the outside. Use it for a target you own or are explicitly authorized to test.
Add authentication carefully
Use a scoped test account when the audit needs an authenticated route. VICE accepts either a cookie string or one authorization header for the intended origin.
Combine both views
Remote evidence shows what the deployed application exposes. Local evidence shows which code and configuration created the behavior. Use both before closing a high-impact finding.
Continue with VICE
Review the open source engine, modules, and scope controls.